are used by medical personnel or other persons with the obligation to preserve confidentiality; e) data are processed by non-profit political, philosophical or religious organisations and trade unions for purposes of their legitimate activity, only for members, sponsors, or other persons related to their activity. These data shall not be disclosed to a third party without the consent of the data subject unless otherwise stipulated by law. ë) data processing is necessary for the purpose of accomplishing a legal obligation and specific rights of the controller in the field of employment in compliance with the Labour Code. (Point 3 abolished) Article 8 International transfer 1. The international transfer of personal data is done with recipients from states which have an adequate level of personal data protection. The level of personal data protection for a state is established by assessing all circumstances related to processing, nature, purpose and duration of processing, country of origin and final destination, legal provisions and security standards in force in the recipient state. States that have an adequate level of data protection are assessed under a decision of the Commissioner. 2. International transfer of personal data with a state that does not have an adequate level of personal data protection may be done when: a) it is authorised by international acts ratified by the Republic of Albania and are directly applicable; b) data subject has given his/her consent for the international transfer; 14 c) the transfer is necessary for the performance of a contract between the data subject and the controller or for the implementation of pre-contractual measures taken in addressing the data subject’s request, or the transfer is necessary for the conclusion or performance of a contract between the controller and a third party, in the interest of the data subject; ç) it is a legal obligation of the controller; d) it is necessary for protecting vital interests of the data subject; dh) it is necessary or constitutes a legal requirement over an important public interest or for exercising and protecting a legal right; e) transfer is done from a register that is open for consultation and provides information to the general public. 3. Exchange of personal data to the diplomatic representations of foreign governments or international institutions in the Republic of Albania shall be considered an international transfer of data. Article 9 International transfer of data that need to be authorized 1. In cases other than those provided for in Article 8 herein, the international transfer of personal data with a state that does not have an adequate level of data protection, shall be carried out upon an authorization from the Commissioner, if adequate safeguards are foreseen with respect to the protection of the privacy and fundamental human rights and freedoms, as well as regarding the exercise of the corresponding rights. 15